CWE-312 · Cleartext Storage of Sensitive Information (page 6)
Page 6 of 9 — CVEs classified under CWE-312, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-39078 | Medium | 4.4 | 2022-04-19 | IBM Security Guardium 10.5 stores user credentials in plain clear text which can be read by a local privileged user. IBM X-Force ID: 215589. |
CVE-2022-0835 | High | 8.1 | 2022-04-11 | AVEVA System Platform 2020 stores sensitive information in cleartext, which may allow access to an attacker or a low-privileged user. |
CVE-2022-25160 | Medium | 5.9 | 2022-04-01 | Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi Electric MELSEC iQ-F se… |
CVE-2022-25158 | Critical | 9.1 | 2022-04-01 | Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi Electric MELSEC iQ-F se… |
CVE-2021-45491 | Medium | 6.5 | 2022-03-28 | 3CX System through 2022-03-17 stores cleartext passwords in a database. |
CVE-2022-26148 | Critical | 9.8 | 2022-03-21 | An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When t… |
CVE-2022-23234 | Medium | 5.5 | 2022-03-16 | SnapCenter versions prior to 4.5 are susceptible to a vulnerability which could allow a local authenticated attacker to discover plaintext HANA credentials. |
CVE-2022-26778 | Medium | 5.3 | 2022-03-10 | Veritas System Recovery (VSR) 18 and 21 stores a network destination password in the Windows registry during configuration of the backup configuration. This co… |
CVE-2021-43590 | Medium | 6.0 | 2022-03-04 | Dell EMC Enterprise Storage Analytics for vRealize Operations, versions 4.0.1 to 6.2.1, contain a Plain-text password storage vulnerability. A local high privi… |
CVE-2021-27757 | High | 7.5 | 2022-03-04 | " Insecure password storage issue.The application stores sensitive information in cleartext within a resource that might be accessible to another control spher… |
CVE-2021-35036 | Medium | 6.5 | 2022-03-01 | A cleartext storage of information vulnerability in the Zyxel VMG3625-T50B firmware version V5.50(ABTL.0)b2k could allow an authenticated attacker to obtain se… |
CVE-2020-14480 | Medium | 5.5 | 2022-02-24 | Due to usernames/passwords being stored in plaintext in Random Access Memory (RAM), a local, authenticated attacker could gain access to certain credentials, i… |
CVE-2021-3551 | High | 7.8 | 2022-02-16 | A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allow… |
CVE-2022-21818 | Medium | 5.4 | 2022-02-15 | NVIDIA License System contains a vulnerability in the installation scripts for the DLS virtual appliance, where a user on a network after signing in to the por… |
CVE-2021-40363 | High | 7.8 | 2022-02-09 | A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMA… |
CVE-2021-42642 | High | 7.5 | 2022-02-02 | PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability that allows an unauthenticat… |
CVE-2022-22789 | Medium | 6.1 | 2022-01-25 | Charactell - FormStorm Enterprise Account takeover – An attacker can modify (add, remove and update) passwords file for all the users. The xx_users.ini file in… |
CVE-2022-23129 | Medium | 5.5 | 2022-01-21 | Plaintext Storage of a Password vulnerability in Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior and ICONICS GENESIS64 versions 10.90 to… |
CVE-2021-31821 | Medium | 5.5 | 2022-01-19 | When the Windows Tentacle docker image starts up it logs all the commands that it runs along with the arguments, which writes the Octopus Server API key in pla… |
CVE-2022-20660 | Medium | 4.6 | 2022-01-14 | A vulnerability in the information storage architecture of several Cisco IP Phone models could allow an unauthenticated, physical attacker to obtain confidenti… |
CVE-2021-45077 | High | 7.5 | 2021-12-30 | Netgear Nighthawk R6700 version 1.0.4.120 stores sensitive information in plaintext. All usernames and passwords for the device's associated services are store… |
CVE-2021-20171 | Medium | 5.5 | 2021-12-30 | Netgear RAX43 version 1.0.3.96 stores sensitive information in plaintext. All usernames and passwords for the device's associated services are stored in plaint… |
CVE-2021-20162 | Medium | 4.9 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 stores credentials in plaintext. Usernames and passwords are stored in plaintext in the config files on the device… |
CVE-2021-35035 | Medium | 4.9 | 2021-12-29 | A cleartext storage of sensitive information vulnerability in the Zyxel NBG6604 firmware could allow a remote, authenticated attacker to obtain sensitive infor… |
CVE-2021-20827 | High | 7.5 | 2021-12-24 | Plaintext storage of a password vulnerability in IDEC PLCs (FC6A Series MICROSmart All-in-One CPU module v2.32 and earlier, FC6A Series MICROSmart Plus CPU mod… |
CVE-2021-43388 | High | 7.5 | 2021-12-14 | Unisys Cargo Mobile Application before 1.2.29 uses cleartext to store sensitive information, which might be revealed in a backup. The issue is addressed by ens… |
CVE-2021-42066 | Medium | 4.4 | 2021-12-14 | SAP Business One - version 10.0, allows an admin user to view DB password in plain text over the network, which should otherwise be encrypted. For an attacker… |
CVE-2021-41090 | Medium | 6.5 | 2021-12-08 | Grafana Agent is a telemetry collector for sending metrics, logs, and trace data to the opinionated Grafana observability stack. Prior to versions 0.20.1 and 0… |
CVE-2021-34544 | Medium | 6.5 | 2021-12-07 | An issue was discovered in Solar-Log 500 before 2.8.2 Build 52 23.04.2013. In /export.html, email.html, and sms.html, cleartext passwords are stored. This may… |
CVE-2021-38949 | Medium | 5.5 | 2021-11-16 | IBM MQ 7.5, 8.0, 9.0 LTS, 9.1 CD, and 9.1 LTS stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 211403. |
CVE-2021-37157 | High | 8.8 | 2021-11-10 | An issue was discovered in OpenGamePanel OGP-Agent-Linux through 2021-08-14. $HOME/OGP/Cfg/Config.pm has the root password in cleartext. |
CVE-2020-10053 | Medium | 5.5 | 2021-11-09 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.12). The affected application writes sensitive data, such as database c… |
CVE-2021-42370 | High | 7.5 | 2021-11-08 | A password mismanagement situation exists in XoruX LPAR2RRD and STOR2RRD before 7.30 because cleartext information is present in HTML password input fields in… |
CVE-2021-25502 | High | 7.9 | 2021-11-05 | A vulnerability of storing sensitive information insecurely in Property Settings prior to SMR Nov-2021 Release 1 allows attackers to read ESN value without pri… |
CVE-2021-38422 | High | 7.8 | 2021-11-03 | Delta Electronics DIALink versions 1.2.4.0 and prior stores sensitive information in cleartext, which may allow an attacker to have extensive access to the app… |
CVE-2020-15935 | Medium | 4.3 | 2021-11-02 | A cleartext storage of sensitive information in GUI in FortiADC versions 5.4.3 and below, 6.0.0 and below may allow a remote authenticated attacker to retrieve… |
CVE-2021-42763 | High | 7.5 | 2021-11-02 | Couchbase Server before 6.6.3 and 7.x before 7.0.2 stores Sensitive Information in Cleartext. The issue occurs when the cluster manager forwards a HTTP request… |
CVE-2021-37842 | High | 7.5 | 2021-11-02 | metakv in Couchbase Server 7.0.0 uses Cleartext for Storage of Sensitive Information. Remote Cluster XDCR credentials can get leaked in debug logs. Config key… |
CVE-2021-29786 | Medium | 6.5 | 2021-10-27 | IBM Jazz Team Server products stores user credentials in clear text which can be read by an authenticated user. IBM X-Force ID: 203172. |
CVE-2021-40527 | High | 8.6 | 2021-10-25 | Exposure of senstive information to an unauthorised actor in the "com.onepeloton.erlich" mobile application up to and including version 1.7.22 allows a remote… |
CVE-2021-38911 | Medium | 4.9 | 2021-10-19 | IBM Security Risk Manager on CP4S 1.7.0.0 stores user credentials in plain clear text which can be read by a an authenticatedl privileged user. IBM X-Force ID… |
CVE-2021-40454 | Medium | 5.5 | 2021-10-13 | Rich Text Edit Control Information Disclosure Vulnerability |
CVE-2021-38915 | Medium | 6.5 | 2021-10-12 | IBM Data Risk Manager 2.0.6 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: 209947. |
CVE-2021-41302 | High | 7.3 | 2021-09-30 | ECOA BAS controller stores sensitive data (backup exports) in clear-text, thus the unauthenticated attacker can remotely query user password and obtain user’s… |
CVE-2021-36165 | Medium | 5.3 | 2021-09-28 | RICON Industrial Cellular Router S9922L 16.10.3(3794) is affected by cleartext storage of sensitive information and sends username and password as base64. |
CVE-2021-29904 | Medium | 5.5 | 2021-09-23 | IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI displays user credentials in plain clear text which can be read by a local user. IB… |
CVE-2021-38150 | Medium | 6.5 | 2021-09-14 | When an attacker manages to get access to the local memory, or the memory dump of a victim, for example by a social engineering attack, SAP Business Client ver… |
CVE-2021-33716 | Medium | 6.5 | 2021-09-14 | A vulnerability has been identified in SIMATIC CP 1543-1 (incl. SIPLUS variants) (All versions < V3.0), SIMATIC CP 1545-1 (All versions < V1.1). An attacker wi… |
CVE-2020-19137 | High | 7.5 | 2021-09-08 | Incorrect Access Control in Autumn v1.0.4 and earlier allows remote attackers to obtain clear-text login credentials via the component "autumn-cms/user/getAllU… |
CVE-2021-35526 | Medium | 6.3 | 2021-09-08 | Backup file without encryption vulnerability is found in Hitachi ABB Power Grids System Data Manager – SDM600 allows attacker to gain access to sensitive infor… |
CVE-2021-1865 | Medium | 5.0 | 2021-09-08 | An issue obscuring passwords in screenshots was addressed with improved logic. This issue is fixed in iOS 14.5 and iPadOS 14.5. A user's password may be visibl… |
CVE-2021-36096 | Medium | 5.2 | 2021-09-06 | Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x… |
CVE-2021-22929 | Medium | 6.1 | 2021-08-31 | An information disclosure exists in Brave Browser Desktop prior to version 1.28.62, where logged warning messages that included timestamps of connections to V2… |
CVE-2021-31989 | Medium | 5.3 | 2021-08-25 | A user with permission to log on to the machine hosting the AXIS Device Manager client could under certain conditions extract a memory dump from the built-in W… |
CVE-2021-40087 | Low | 2.7 | 2021-08-25 | An issue was discovered in PrimeKey EJBCA before 7.6.0. When audit logging changes to the alias configurations of various protocols that use an enrollment secr… |
CVE-2021-30997 | High | 7.5 | 2021-08-24 | A S/MIME issue existed in the handling of encrypted email. This issue was addressed by not automatically loading some MIME parts. This issue is fixed in iOS 15… |
CVE-2021-31820 | High | 7.5 | 2021-08-18 | In Octopus Server after version 2018.8.2 if the Octopus Server Web Request Proxy is configured with authentication, the password is shown in plaintext in the U… |
CVE-2020-36473 | Low | 3.7 | 2021-08-14 | UCWeb UC 12.12.3.1219 through 12.12.3.1226 uses cleartext HTTP, and thus man-in-the-middle attackers can discover visited URLs. |
CVE-2020-18759 | High | 7.5 | 2021-08-13 | An information disclosure vulnerability exists in the EPA protocol of Dut Computer Control Engineering Co.'s PLC MAC1100. |
CVE-2021-37548 | High | 7.5 | 2021-08-06 | In JetBrains TeamCity before 2021.1, passwords in cleartext sometimes could be stored in VCS. |
CVE-2021-33325 | Medium | 4.9 | 2021-08-03 | The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19, and 7.2 before fix pack 7, user… |
CVE-2021-33323 | High | 7.5 | 2021-08-03 | The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, autosaves form values… |
CVE-2021-37468 | Low | 3.3 | 2021-07-25 | NCH Reflect CRM 3.01 allows local users to discover cleartext user account information by reading the configuration files. |
CVE-2021-37452 | Medium | 5.5 | 2021-07-25 | NCH Quorum v2.03 and earlier allows local users to discover cleartext login information relating to users by reading the local .dat configuration files. |
CVE-2021-31581 | High | 7.9 | 2021-07-22 | The restricted shell provided by Akkadian Provisioning Manager Engine (PME) can be escaped by abusing the 'Edit MySQL Configuration' command. This command laun… |
CVE-2020-22741 | High | 7.5 | 2021-07-19 | An issue was discovered in Xuperchain 3.6.0 that allows for attackers to recover any arbitrary users' private key after obtaining the partial signature in mult… |
CVE-2020-4980 | Medium | 6.5 | 2021-07-16 | IBM QRadar SIEM 7.3 and 7.4 uses less secure methods for protecting data in transit between hosts when encrypt host connections is not enabled as well as data… |
CVE-2021-20510 | Medium | 4.4 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 198299 |
CVE-2020-12731 | High | 7.5 | 2021-07-15 | The MagicMotion Flamingo 2 application for Android stores data on an sdcard under com.vt.magicmotion/files/Pictures, whence it can be read by other application… |
CVE-2021-31817 | High | 7.5 | 2021-07-08 | When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written to the OctopusServ… |
CVE-2021-31816 | High | 7.5 | 2021-07-08 | When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written to the OctopusServ… |
CVE-2021-36158 | Medium | 5.9 | 2021-07-05 | In the xrdp package (in branches through 3.14) for Alpine Linux, RDP sessions are vulnerable to man-in-the-middle attacks because pre-generated RSA certificate… |
CVE-2021-29481 | Medium | 6.5 | 2021-06-29 | Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the default configuration of client side sessions results in unencrypted, but s… |
CVE-2021-29956 | Medium | 4.3 | 2021-06-24 | OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on the user's local disk. The master pass… |
CVE-2021-29954 | Critical | 9.8 | 2021-06-24 | Proxy functionality built into Hubs Cloud’s Reticulum software allowed access to internal URLs, including the metadata service. This vulnerability affects Hubs… |
CVE-2021-29950 | High | 7.5 | 2021-06-24 | Thunderbird unprotects a secret OpenPGP key prior to using it for a decryption, signing or key import task. If the task runs into a failure, the secret key may… |
CVE-2021-27487 | Medium | 5.5 | 2021-06-16 | ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products contain credentials stored in plaintext. This could allow an attacker to gain access to sen… |
CVE-2021-28858 | Medium | 5.5 | 2021-06-15 | TP-Link's TL-WPA4220 4.0.2 Build 20180308 Rel.37064 does not use SSL by default. Attacker on the local network can monitor traffic and capture the cookie and o… |
CVE-2021-23211 | Medium | 6.0 | 2021-06-11 | Cleartext Storage of Sensitive Information in Memory vulnerability in Gallagher Command Centre Server allows Cloud end-to-end encryption key to be discoverable… |
CVE-2021-23182 | Medium | 6.0 | 2021-06-11 | Cleartext Storage of Sensitive Information in Memory vulnerability in Gallagher Command Centre Server allows OSDP reader master keys to be discoverable in serv… |
CVE-2021-32942 | Medium | 6.6 | 2021-06-09 | The vulnerability could expose cleartext credentials from AVEVA InTouch Runtime 2020 R2 and all prior versions (WindowViewer) if an authorized, privileged user… |
CVE-2020-15384 | Medium | 5.3 | 2021-06-09 | Brocade SANNav before version 2.1.1 contains an information disclosure vulnerability. Successful exploitation of internal server information in the initial log… |
CVE-2020-29324 | High | 7.5 | 2021-06-04 | The DLink Router DIR-895L MFC v1.21b05 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an unauthentica… |
CVE-2021-31855 | Medium | 6.5 | 2021-06-02 | KDE Messagelib through 5.17.0 reveals cleartext of encrypted messages in some situations. Deleting an attachment of a decrypted encrypted message stored on a r… |
CVE-2021-21734 | Medium | 6.5 | 2021-05-28 | Some PON MDU devices of ZTE stored sensitive information in plaintext, and users with login authority can obtain it by inputing command. This affects: ZTE PON… |
CVE-2018-16498 | Medium | 5.5 | 2021-05-26 | In Versa Director, the unencrypted backup files stored on the Versa deployment contain credentials stored within configuration files. These credentials are for… |
CVE-2021-29683 | Medium | 6.5 | 2021-05-20 | IBM Security Identity Manager 7.0.2 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: 199998. |
CVE-2021-25644 | High | 7.5 | 2021-05-19 | An issue was discovered in Couchbase Server 5.x and 6.x through 6.6.1 and 7.0.0 Beta. Incorrect commands to the REST API can result in leaked authentication in… |
CVE-2021-30183 | High | 7.5 | 2021-05-14 | Cleartext storage of sensitive information in multiple versions of Octopus Server where in certain situations when running import or export processes, the pass… |
CVE-2021-20995 | Medium | 5.3 | 2021-05-13 | In multiple managed switches by WAGO in different versions the webserver cookies of the web based UI contain user credentials. |
CVE-2021-25645 | Medium | 4.4 | 2021-05-10 | An issue was discovered in Couchbase Server before 6.0.5, 6.1.x through 6.5.x before 6.5.2, and 6.6.x before 6.6.1. An internal user with administrator privile… |
CVE-2021-22206 | Medium | 6.8 | 2021-05-06 | An issue has been discovered in GitLab affecting all versions starting from 11.6. Pull mirror credentials are exposed that allows other maintainers to be able… |
CVE-2021-21547 | Medium | 6.4 | 2021-04-30 | Dell EMC Unity, UnityVSA, and Unity XT versions prior to 5.0.7.0.5.008 contain a plain-text password storage vulnerability when the Dell Upgrade Readiness Util… |
CVE-2020-22783 | Medium | 6.5 | 2021-04-28 | Etherpad <1.8.3 stored passwords used by users insecurely in the database and in log files. This affects every database backend supported by Etherpad. |
CVE-2021-31791 | High | 7.5 | 2021-04-23 | In Hardware Sentry KM before 10.0.01 for BMC PATROL, a cleartext password may be discovered after a failure or timeout of a command. |
CVE-2021-25898 | High | 7.5 | 2021-04-23 | An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. Passwords are stored in unencrypted source-code text files. This was noted when acc… |
CVE-2021-31539 | Medium | 5.5 | 2021-04-23 | Wowza Streaming Engine before 4.8.8.01 (in a default installation) has cleartext passwords stored in the conf/admin.password file. A regular local user is able… |
CVE-2021-3473 | Medium | 4.5 | 2021-04-13 | An internal product security audit of Lenovo XClarity Controller (XCC) discovered that the XCC configuration backup/restore password may be written to an inter… |
CVE-2021-25692 | Medium | 4.6 | 2021-04-06 | Sensitive smart card data is logged in default INFO logs by Teradici's PCoIP Connection Manager and Security Gateway prior to version 21.01.3. |
CVE-2020-11924 | Medium | 5.5 | 2021-04-02 | An issue was discovered in WiZ Colors A60 1.14.0. Wi-Fi credentials are stored in cleartext in flash memory, which presents an information-disclosure risk for… |